Thank you! I was struggling with this for a while and the temporary solution was to set packageType to "mixed", which is obviously not a good approach. Followed your instructions and it resolved the issue immediately.

I know this is an old question, but our team ran into a very similar issue and I posted details of our solution here: https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/aem-session-cookie-with-httponly-and-secure-flag/qaq-p/206712/comment-id/75793#M75793

I know this is an old question, but our team ran into it recently and found a solution that may be helpful to others. I decompiled AEM's TokenUtil class and tried to find the place where the login-token cookie is set, and the secure flag is set or not based on the request's isSecure() method. If the...

I'm having the exact same issue as the other folks on this issue. arunjoshh​ are you able to confirm that Adobe has a patch available?